LTX Division of Broadridge Business Process Outsourcing, LLC 


Business Continuity Plan Disclosure 


I. Summary 


In accordance with FINRA Rule 4370, the LTX Division of Broadridge Business Process 
Outsourcing, LLC (the “Firm” and “LTX”’’) is providing you with the following disclosure statement 
that describes in general how our Firm will respond to events that may significantly disrupt our 
business. Our Firm is committed to protecting its employees and its institutional customers (the 
“Customers’’) through its dedication to business continuity management (“Business Continuity”) in 
accordance with FINRA rules. Business Continuity is mandated by regulatory rules; corporate 
policy; developed and tested regularly by the Firm’s technology team that is comprised of full-time 
staff with expertise in this field. This document shall serve as an executive summary of the Firm’s 
Business Continuity Plan and is also available on the Firm’s website. 


Il. Firm Policy 


Our Business Continuity Plan (BCP) anticipates two kinds of broad Significant Business Disruption 
(SBD)’s; internal and external. In each instance, we will exhibit readiness and preparedness to the 
situation. 


e Internal SBD’s affect only our firm’s ability to communicate and do business, i.e. loss of 
primary facilities or data center, pandemic flu. 

e External SBD’s prevent the operation of the securities markets or a number of firms, such 
as a terrorist attack, pandemic flu, a city flood, or a wide-scale, regional disruption. Our 
response to an external SBD depends more heavily on other organizations and systems. 


We have two approaches to providing our Customers with continued service at the time of an SBD. 
The first approach deals with shifting resources between our three hot locations. The second 
approach is to have selected employees work remotely. 


e Safeguarding employees’ lives and firm property. 

e Safeguarding customer assets. 

e Supporting our Customers. 

e Comply with industry regulations. 

e Conducting a financial and operational assessment. 

e Quickly recovering and resuming operations. 

e Protecting our client’s books and records, and allowing the customers to transact required 
business. 

e Ensure critical functions can be recovered within required guidelines. 


Ill. Recovery Strategy 


We have several approaches which enable us to ensure our outsourcing Customers have required 
recovery or continued service for mission critical activities: 


e We maintain three hot locations (New York, NY, Newark, NJ, and Edgewood, NY) 
where work is performed, and resources can be immediately shifted. 
e LTX associates have the ability to work remotely. 


We have identified various possible business interruption scenarios and have established plans to 
ensure mission critical functions will be performed or recovered within a specified period of time 
based on client requirements. Scenarios include but are not limited to: 


e Loss of our facilities. 

e 9% of staff unable to get to work, i.e. pandemic flu. 
e System outage. 

e Industry or Exchange issues. 

e Non-Industry disasters. 


“Mission critical functions” are those that require the operating of the LTX application and 
providing Customers with communication about their activity on the LTX application. All such 
functions will be treated in a time sensitive manner, in compliance with regulatory and client 
requirements while mitigating market risk to both the firm and our Customers. 


IV. Operation Locations: 
LTX Division 


The LTX mitigates the risk of losing a facility and certain other scenarios by reliance on employee’s 
ability to log into our systems from home via VPN connection. Our IT systems provided by 
Broadridge corporate IT which mitigates risk by synchronous backup of locations in New Jersey 
and Long Island maintaining three distinct hot locations. “Mission critical functions” can be 
performed out of all locations to safeguard against interruptions. 


e New York Location (Manhattan) (Hot Site). 
e Long Island Location (Edgewood) (Hot Site). 
e New Jersey Location (Newark) (Hot Site). 


V. BCP Structure: 
We have established formal governance, planning and escalation processes designed to: 


e Provide an organized and integrated response to an event. 

e Provide prompt and appropriate response to an event to reduce impact and mitigate risk. 
e Recover critical operation functions in a timely manner. 

¢ Ensure our plans are periodically reviewed and tested. 

e Ensure organization is continually improving and responds to environment changes. 

e Communicate effectively with our associates, Customers and other key stakeholders. 





GTO - LTX Crisis Management Team 


e Coordinate overall business response and recovery 

e Coordinate and formulate communication strategy (Corporate, employees, vendors, 
customers, media, regulators, other key partners) 

e Conduct financial and regulatory assessment 

e Determine overall firm-wide strategy and policies 

e Executive decision - e.g., declare event and define scenarios 

e Respond to escalated issues 

e Conduct post-mortem 

e Interface with Corporate executives 


e Coordinate overall business response and recovery. 

e Coordinate and formulate communication strategy (Corporate, employees, vendors, 
customers, media, regulators, other key partners). 

e Conduct financial and regulatory assessment. 

e Determine overall firm wide strategy and policies. 

e Executive decision making e.g. declare event and define scenarios. 

e Respond to escalated issues. 

e Conduct post-mortem. 

e Interface with Corporate executives. 


Operations Executive Recovery Team (OERT) 


e Coordinate overall Operations recovery, response and assessment activities 

e Perform periodic and regular evaluations and updates to BCP strategies including test 
results, readiness metrics and impact of new procedures, processes and policies 

e Identify client, employee, vendor, technology, facility, financial and regulatory impact 

e Communicate with staff, clients and key parties 

e Ensure ongoing testing and organization readiness 

e Implement decisions and policies from the GTO - LTX Crisis Management Team 

e Escalate impact, issues etc. to GTO - LTX Crisis Management Team 

e Identify industry impact/decisions and participate in meetings / conference calls 

e Conduct post-mortem 

e Formulate and coordinate ongoing strategies, policies and decisions 

e Maintain and periodically test calling trees and home access 

e Test and update plan including participation in technology and industry testing. 


Operations Emergency Response Coordinators (OERC) 


e Coordinate Operations recovery, response and assessment activities. 

e Interact and communicate with Corporate BCP, OERT and Operations recovery 
coordinators. 

e Conduct post-mortem. 

e Maintain BCP documentation including defining mission critical activities and 
recovery times. 

e Ensure ongoing Operations readiness including staff training. 

e Educate staff, key partners and Customers. 

e Participate in Industry conference calls. 

e Monitor and publish financial, regulatory and other key metrics. 

e Prepare and review readiness metrics. 

e Determine client processing requirements and interim work rules e.g. delay non- 
critical activity, set business standards and recovery times. 

e Plan and coordinate organization tests and readiness drills. 

e Define ongoing and event specific requirements. 


VI. Notifications: 
Customer 


Each Customer has a representative in Relationship Management or a Customer Service Specialist 
that will be responsible for communication. Conference calls will be conducted as needed to provide 
updates, coordinate activities and monitor issues. 


Internal Notification 


e Recovery and Response teams are activated. 
e Firm wide calling tree will be engaged. 
e Employee BCP hotline will be updated. 


We also rely on all our Customers to provide us with a list of key contact persons to ensure a proper 
flow of communication. This list will be periodically updated. 


Critical Business Constituent, Bank and Counter-Party Impact 


We will contact our critical business constituents, banks, and counterparties to determine alternate 
arrangements to continue our operational activities during disruptive events. During any disruptive 
event, we will again contact all of these critical entities, rapidly assess the extent and expected 
duration of any outages to operational resources and infrastructure, and implement these alternate 
arrangements. 


Regulatory Reporting 


The Firm is subject to regulation by the Securities and Exchange Commission and the Financial 
Industry Regulatory Authority for work that it is performing as a securities brokerage firm on behalf 
of its Customers. The Firm files reports with our regulators using paper copies in the U.S. Mail, and 
electronically using facsimile, email and FINRA’s web-based regulatory filing system. During any 
disruptive event, we will determine from communications received from our regulators what means 
of filing are still available to our Firm and use the means closest in speed and form to our previous 
method. 


VII. Planning and Ongoing Readiness 


e During our conversion process, we will work with our customers to: 


e Define mission critical activities, activities which can be delayed and 
activities which can be temporarily suspended as well as recovery times. 

e Determine resources required to support mission critical activities as well as 
identify staff (at client and Broadridge BPO) who can perform those 
functions. 

e Determine locations with available space where functions can be performed 
including remote access and client locations. 


Define self-clearing firm’s ability to bring work in-house on temporary basis. 
Understand client’s firm requirements and testing schedule. 

Establish escalation process and calling trees. 

Document BCP plan. 

Ensure our actions are integrated with your corporate strategy. 


After the conversion process, we will perform the following activities on a periodic (at 
least annual) basis: 


Conduct integrated calling tree drills. 

Update and publish contact lists. 

Review and update the BCP plan. 

Conduct internal tests by shifting work, rotating staff or conducting desktop 
exercises. 

Participate as required in industry, technology and firm testing. 

Conduct planning and training sessions with our staff. 


